peerjs needs Content-Security-Policy `script-src: unsafe-eval` about peerjs

[jonasgloning]

Hey Andrei, thank you for the bug report!

We agree this is a bug. PeerJS shouldn’t be relying on unsafe-eval.

Sadly this appears to be a bit more complicated than your proposed fix in our case:
The current bundling/typescript setup doesn’t allow for importing from a package export yet. We’ll hopefully address this soon, but this could explode in complexity and will take some time.

[andreialecu]

kriszyp/cbor-x#102 got merged, I believe the types should behave better now.

[jonasgloning]

There's a new version on @rc https://www.npmjs.com/package/peerjs/v/1.5.3-rc.1 that includes a fix (#1248). You can install it with npm i --save peerjs@rc

Import paths still break some bundler implementations we test against — one of the reasons for the large delay.
We decided to still merge the PR. Projects affected should (and can) just update their tooling.

The team will meet again and release a new stable version on Saturday, 11th of May.